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We present two schemes for multiparty quantum remote secret conference in which each legiti- 
mate conferee can read out securely the secret message announced by another one, but a vicious 
eavesdropper can get nothing about it. The first one is based on the same key shared efficiently 
and securely by all the parties with Greenberger-Horne-Zeilinger (GHZ) states, and each conferee 
sends his secret message to the others with one-time pad crypto-system. The other one is based on 
quantum encryption with a quantum key, a sequence of GHZ states shared among all the conferees 
and used repeatedly after confirming their security. Both these schemes are optimal as their intrinsic 
efficiency for qubits approaches the maximal value. 
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Quantum communication supplies some novel ways for 
transmitting message securely. For example, quantum 
key distribution (QKD) [J SI, 11, 0, H, Q , the original ap- 
plication of quantum mechanics, can be used to create a 
private key between two authorized users, Alice and Bob. 
The noncloning theorem forbids a vicious eavesdropper, 
say Eve to copy an unknown quantum state without 
disturbing it. By analysing the error rate of samples 
chosen randomly, Alice and Bob can determine whether 
there is an eavesdropper in the quantum line 1 L With 
quantum secret sharing (QSS) @, 0, i, 03, EJlll O, 
a boss can generate a private key with his agents, i.e., 
K A = K B © K c © K D © • • •. Here K A is the key of the 
boss Alice, K{ (i = B,C,D,- ■ •) are the keys of Alice's 
agents. In this way, Alice can send her secret message 
to her agents who can read out it if and only if they co- 
operate, otherwise none can obtain a useful information 
about the message. Also, QSS provides a secure way for 
sharing an unknown state [3, EH, EH, E3] • 

Recently, a new branch of quantum communication, 
quantum secure direct communication (QSDC) was pro- 
posed and has been actively pursued [H, EH S3, SH, S3, 
M, SI SE SE S3, SI, SI . QSDC makes a party commu- 
nicate another one directly and securely, different from 
QKD. In detail, the sender sends his secret message di- 
rectly to the receiver without creating a private key and 
then encrypting the message with it. As pointed out in 
Ref. H, 

a secure quantum direct communication proto- 
col requires the users to transmit the quantum states in a 
date block. Moreover, the two legitimate users can detect 
the eavesdropper before they encode the secret message 
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on the quantum states, and can read out the message di- 
rectly without exchanging an additional classical bit for 
each qubit except for those used for checking eavesdrop- 
ping. In this way, the two-step QSDC protocol [l8| and 
the quantum one-time pad QSDC protocol [l| proposed 
by Deng et al. satisfy all the requirements. So do the pro- 
tocol with quantum superdense coding [201 ] and that with 
multi-particle Green-Horne-Zeilinger (GHZ) state [2l| . 

Another class of quantum communication protocols 
used to transmit secret message is called deterministic 
secure quantum communication (DSQC) [3l[, such as 
the schemes [22|, S| with quantum teleportation and en- 
tanglement swapping, and those [IE S| based on secret 
transmitting order of particles. Although the secret mes- 
sage can be read out only after the two authorized users 
exchange an additional classical bit for each qubit, none 
of the users needs to transmit the qubits that carry the 
secret message, which maybe make those protocols more 
secure than others in a noise channel and more conve- 
nient for quantum error correction [31!]. In particular, 
we introduced a DSQC protocol with only single-photon 
measurements and a feasible quantum signal, nonmaxi- 
mally entangled states [3l| . 

More recently, two novel concepts for direct commu- 
nication are proposed. One is quantum secret report in 
which many agents report directly their secret messages 
to a boss in one-way direction [32| . The other is quantum 
broadcast communication [33j with which one can broad- 
cast his secret message to many legitimate receivers. In 
this Letter, we will present two schemes for multiparty 
quantum remote secret conference (MQRSC) in which 
any legitimate conferee can send securely his secret mes- 
sage to the other legitimate parties who participate in a 
remote secret conference, but a vicious eavesdropper can 
get nothing about the messages. The first one is based on 
the same classical key shared efficiently and privately by 
all the parties with Greenberger-Horne-Zeilinger (GHZ) 
states. The other one is based on quantum encryption 
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with a quantum key, a sequence of GHZ states shared 
among all the parties and used repeatedly after confirm- 
ing their security. 

Now, let us describe the principle of our MQRSC pro- 
tocol based on the same private key shared by all the 
parties of the secret conference. Suppose there are three 
remote conferees, say Alice, Bob and Charlie. They first 
share the same key, say Ka — Kb = Kc securely and 
then use them to encrypt their secret messages with clas- 
sical one time-pad crypto-system. Here Ka, Kb and Kc 
are the classical keys obtained by Alice, Bob and Charlie, 
respectively. In detail, they can use some three-particle 
GHZ states to create their keys efficiently. The GHZ- 
state is 

Wabc = i(|000) + |lll)W, 

= -^[(\+x)a\+x)b + \-x)a\-x)b)\+x) c 
+ (| + x) A \ - x) B + | - x)a\ + x) B )\ - x) c - 



(1) 

Here |0) = \+z) and |1) = \—z) are the eigenvectors of the 
measuring basis (MB) a z , and | +x) = ^(|0) + |1)) and 

| - x) = ^(|0) - |1)) are those of the MB a x . That is, a 
remote conferee, say Alice prepares a three-particle quan- 
tum system in the GHZ state \iJj)abc, an d then sends the 
particle B to Bob and the particle C to Charlie. All the 
three conferees choose the MBs a z and a x with the prob- 
abilities 1 — p and p to measure their particles. After 
comparing in public their MBs, the three conferees keep 
their outcomes obtained when they all choose the MB 
a z or the MB a x . The probabilities that they obtain a 
correlated result with the MBs a z and a x are (1 — p) 3 
and p 3 , respectively. 

Alice, Bob and Charlie choose all the outcomes ob- 
tained with the MB a x and a subset of those with the 
MB a z as the samples to analyse the security of the 
transmission, similar to Bcnnctt-Brassard-Mermin 1992 
(BBM92) QKD protocol [3] and the modified Bennett- 
Brassard 1984 (BB84) QKD protocol [5]. If the trans- 
mission is secure, the three conferees can get the same 
private key by distilling the remaining outcomes obtained 
with the MB <r z . Assume that the ratio of the number of 
sample particles to that of particles transmitted is r. As 
the symmetry, p 3 — r/2 (half of the samples are the out- 
comes obtained by the conferees with the MB a x ). Then 
the probability that the three remote conferees obtain 
their raw key, p r k without eavesdropping is 



Prk = (1 - \/^) 3 PtPd, 



(2) 



where pt and pa are the probabilities of the transmission 
and the detectors, respectively. 

In essence, this MQRSC protocol is just a special QKD 
protocol. That is, all the conferees generate first the same 



private key with GHZ states efficiently and then use it to 
encrypt and decrypt their messages. Different from QSS 
0, [3, H, E3, EH EI EH , all the authorized conferees are 
honest. They can take the measurement with the MB a z 
on the GHZ states to obtain the same outcomes, and use 
all the outcomes obtained with the MB a x as the samples 
for eavesdropping check. 
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FIG. 1: The principle of the multiparty quantum remote 
secret conference scheme based on quantum encryption with 
GHZ states. CNOT: controlled not gate. 

With quantum memory [34|, we can modify this 
MQRSC protocol to transmit the secret message directly 
and securely, without generating the same private classi- 
cal key and then encrypt the message, similar to QSDC 
PH El SU E3- To this end, the three conferees, Alice, 
Bob and Charlie, first share a sequence of three-particle 
GHZ states \^)abc = 75 (I 000 ) + \U1))abc, and then 
use them as a quantum key for encrypting and decrypting 
the secret message transmitted. We give out all the steps 
for this multiparty quantum remote secret conference as 
follows. 

(1) The three conferees, Alice, Bob and Charlie, share 
a sequence of three-particle GHZ-state quantum systems 
in the same state \iP)abc = -^(|000) + \1H))abc se- 
curely, i.e., ordered N GHZ-state tripartite quantum 
systems. In detail, one of the three conferees, say Al- 
ice, prepares a sequence of three-particle GHZ states 
Wabc = -^(|Q0Q)+|111))abc- For each GHZ state, Al- 
ice sends the particle Bj (j = 1, 2, . . . , N) to Bob and the 
particle Cj to Charlie, respectively. For checking eaves- 
dropping, Alice chooses randomly some of the GHZ states 
as their samples, and requires Bob and Charlie to mea- 
sure their correlated particles by choosing randomly the 
MB a x or the MB <r y . Also Bob and Charlie announce in 
public their MBs and the outcomes of the measurements. 
Here | + y) = ^(|0) + and | - y) = ^(|0> - z|l», 
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- -j=y{\+y)A\-y) B + \-y) A \ + y)B)\ + x) c 

+(l + v)a\ + v)b + \- v)a\ - v)b)\ - x) c . 

(3) 

When both Bob and Charlie choose the MB a x or the 
MB a y , Alice chooses the MB a x to measure her particle 
A as well, otherwise, Alice measures her particle with the 
MB a y . In this way, the three conferees always obtain 
the correlated outcomes of their measurements on the 
samples if there is no eavesdropper, similar to the two- 
step protocol [HI and BBM92 QKD protocol 3]. In a 
noise channel, they can obtain securely a short sequence 
of GHZ states with entanglement purification. 

(2) The three conferees encrypt and decrypt their se- 
cret message directly with their quantum key. In detail, 
a conferee, say Alice wants to send her secret message to 
the other two conferees, Bob and Charlie. She first pre- 
pares ordered N traveling particles St ■ [Ti,T 2 , . . . , Tjy], 
and then encrypts the j-th (j = 1,2,..., N) traveling 
particle Tj by using a controlled-not (CNOT) gate with 
the particle Aj in her quantum key, shown in Fig.l. 
Suppose the state of a traveling particle Tj is \\)t = 
a\0) +p\l). Here \ X )t € {|0>,|1>}, i.e., a(3 = 0. After 
the CNOT operation done by Alice with the particle Aj 
as the control qubit and the traveling particle Tj as the 
target qubit, the state of the quantum system composed 
of the particles Aj , Bj , Cj and Tj becomes 

W)abct = i(a|0) A |0) B |0)c|0) T + /3|0)A|0) B |0)c|l>T 
+ a|l) A |l) B |l) c |l) T + /?|l) A |l) B |l) c |0) T ). 

(4) 

Alice sends the traveling particles St to Bob. For 
reading out the information on the traveling particles 
St, Bob prepares a sequence of auxiliary particles Sb ■ 
[b\, 62 ; • • • j frjv] whose states are initially \i)b = |0), and 
takes a CNOT gate on an auxiliary particle bj and a par- 
ticle Bj in the quantum key by using the particle Bj as 
the control qubit. Moreover, Bob takes another CNOT 
gate on the traveling particle Tj and the auxiliary parti- 
cle bj by using the traveling particle as the control qubit. 
Thus the state of the auxiliary particle bj is changed into 
the one \f)b as the same as the original state of the trav- 
eling particle Tj. Whether the state \x)t is |0) or |1) 
which represent the bit values and 1 in the secret mes- 
sage respectively, Bob can read out this information with 
a measurement a z on the auxiliary particle bj. Simulta- 
neously, Bob sends the traveling particles St to a next 
conferee, say Charlie. 

Certainly, on one hand, Charlie can also do the same 
operations as those done by Bob to read out the informa- 
tion about Alice's secret message, shown in Fig.l. On the 
other hand, Charlie can measure the traveling particles 
St after he takes a CNOT gate on each traveling parti- 
cle Tj and the particle Cj in the quantum key by using 
the particle Cj as the control qubit. As all the quan- 
tum systems in the quantum key are in the GHZ state 



\^)abc = ^ (1 000) + |lll))^sci Charlie can recover the 
original state of each traveling particle Tj and then read 
out the information about Alice's message directly. 

(3) The three conferees use their quantum key repeat- 
edly to encrypt and decrypt their secret message in next 
round if they confirm that their quantum communica- 
tion is secure. For checking the security of their quantum 
communication, the three conferees can choose a subset 
of quantum systems in their quantum key as samples to 
analyse their error rate, same as the process for sharing a 
sequence of GHZ states securely in the step 1. Certainly, 
the new quantum key is shorter a little than the original 
one. 

This MQRSC protocol is secure if the quantum key is 
secure as it is just a quantum one-time pad cryto-system 
[U[l9j in this time. None can read out the secret message 
carried by the traveling particles St if he does not know 
the information about the quantum key as each travel- 
ing particle Tj is randomly in the states |0) and |1) after 
the conferee Alice encrypts it with her particle Aj and a 
CNOT gate, i.e, the density matrix for a traveling parti- 
cle T is pt = \ i g ^ ^ whether its original state is |0) 

or |1). Thus this MQRSC protocol can be made to be 
secure. 

It is straightforward to generalize these two MQSRC 
schemes to the case with M legitimate conferees, say Al- 
ice, Bob, Charlie, . . ., and Mac. For the first MQSRC 
scheme, Alice, in this time, prepares an M-particle GHZ 
state 

\*)ab...m = ^(l° 00 • • -°> + I 111 • • • 1 )ab...m, (5) 

and sends the particles B, C, . . ., and M to Bob, Charlie, 
. . ., and Mac, respectively. Each of the conferees takes 
the MBs <j z and a x to measure his particle with the prob- 
abilities 1—p and p, respectively. Similar to the case with 
three conferees, the probability that all the conferees ob- 
tain the same outcomes with the MB a z in principle is 
(1 — p) M ■ Then the probability that the M remote con- 
ferees obtain their raw key, p' rk without eavesdroppers 
is 

Prk = (1 - M ]/1) M P'A, (6) 

where p' t and p' d are the total probabilities of the trans- 
mission among the M conferees and their detectors, re- 
spectively. Here 

M M 

Pt=n^«' Pd=i[Pdi> (7) 

1=2 1=1 

where p' dl < 1 is the probability of the detector of the l- 
th conferee, p' tl < 1 is the probability of the transmission 
between the (I — l)-th conferee and the l-th conferee. 
Obviously, the probability p' rk decreases largely with the 
increase of the number M. 
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For generalizing our second MQRSC scheme to the 
case with M conferees, all the conferees should first 
share securely a sequence of Af-particle GHZ states 
\*)ab...m = 7^(1000 . . .0) + |111 . . . 1)ab...m- This task 
can be accomplished with the same way as that in the 
case with three conferees. In the process of encrypt- 
ing and decrypting their secret messages, Alice first en- 
crypts her secret message on the traveling particles St '■ 
[T\, T 2 , . . . T N ] with the particles S A ■ [A\, A 2 , . . . A N ] 
and CNOT gates, and then sends the particles St to 
Bob. Bob decrypts the secret message with his auxiliary 
particles Sb and the particles Sb ■ [Bi, B2, . ■ . Bjv] in the 
quantum key, and measures the auxiliary particles with 
the MB a z , not the traveling particles St ■ He sends the 
particles St to a next conferee, say Charlie, shown in 
Fig.l. All the other conferees just repeat the operations 
done by Bob except for the last one, Mac. After taking a 
CNOT gate on each traveling particle Tj and his particle 
Mj in the quantum key by using the particle Mj as the 
control qubit, Mac reads out Alice's message by measur- 
ing the traveling particles St with the MB a z . In order 
to use their quantum key repeatedly, all the conferees 
should check the security of their quantum communica- 
tion by sampling some of the quantum systems in their 
quantum key for analysing their error rate, similar to 



that in the case with three conferees. 

Compared with quantum secret report [32| and quan- 
tum broadcast communication (33j , each of the legitimate 
conferees can send his message to the other conferees, not 
the case in which only the agents can send their secret 
messages to a boss in a one-way direction [33 or a special 
one can send his message to his agents [331 ] . In our sec- 
ond MQRSC scheme, only the traveling particles St are 
transmitted among the M legitimate conferees after they 
share securely their quantum key, a short sequence of 
GHZ states which can be used repeatedly. As almost all 
the particles can be used to transmit the secret message, 
the intrinsic efficiency for qubits in these two MQRSC 
schemes approaches the maximal value. Thus they both 
are optimal. 

In summary, we have presented two multiparty quan- 
tum remote secret conference schemes with GHZ states. 
One is based on the same classical key generated with 
Af-particle GHZ states and the measurements with two 
biased measuring bases. The other is based on encrypting 
and decrypting with a quantum key, a sequence of GHZ 
states \^) A b...m = 75GOOO . . .0) + jlll . . . 1)ab...m- As 
their intrinsic efficiency for qubits approaches the maxi- 
mal value, both are optimal. 
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